CVE-2026-77415: JSONata arbitrary code execution via crafted expressions

CVE-2026-77415 · Severity: critical · CVSS 4 · Published 2026-08-21

JSONata is a JavaScript library for querying and transforming JSON data through declarative expressions. Before version 2.2.1 and 1.8.8, attackers could craft malicious JSONata expressions that execute arbitrary system code on servers or applications using the library. This allows remote code execution without authentication, potentially leading to complete system compromise, data theft, or service disruption.

Technologies: JSONata, jsonata (npm). Vendors: JSONata, npm.

Quick answers

Is CVE-2026-77415 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77415 being exploited in the wild.
How severe is CVE-2026-77415?
Critical severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?
JSONata >=2.0.0, <2.2.1 and <1.8.8; jsonata (npm) SEMVER:introduced=2.0.0,fixed=2.2.1.
Is there a fix for CVE-2026-77415?
Yes. jsonata (npm): upgrade to 2.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77415 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77415?
Check whether you run JSONata or jsonata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jsonata (npm): upgrade to 2.2.1 or later
    npm install jsonata@2.2.1

Technical details

The vulnerability stems from multiple unsafe design choices in JSONata's expression evaluation engine. Attackers can override the $clone function to mutate internal objects during transform operations, destructure jsonata built-in functions like $merge.* to access lambda internals, and exploit applyProcedure's use of forEach without Array.prototype isolation, enabling prototype pollution. By chaining these primitives, an attacker can escalate from expression manipulation to constructor-based code execution, invoking child_process.execSync or similar Node.js APIs. The attack requires no prior authentication or user interaction—any application accepting untrusted JSONata expressions is vulnerable. Patches were applied via three separate PRs (#799, #800, #802) affecting expression transformation safety, lambda destructuring protection, and procedure argument handling, shipping in JSONata 2.2.1 and backported to 1.8.8.

Affected products

  • jsonata-js jsonata >=2.0.0, <2.2.1 and <1.8.8

Identifiers

  • CVE-2026-77415
  • GHSA-66mm-25pp-rfff

Timeline

  • 2026-07-13: disclosed: JSONata vulnerability initially published
  • 2026-07-13: patched: Fixed in JSONata 2.2.1 via PRs #799, #800, #802
  • 2026-07-13: patched: Fixes backported to JSONata 1.8.8
  • 2026-08-21: advisory: GitHub Advisory Database publication (GHSA-66mm-25pp-rfff, CVE-2026-77415)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.